Overview
The Fortify AST Scan component provides seamless integration of OpenText Application Security (Fortify Software Security Center) for automated Application Security Testing (AST) into your GitLab CI/CD pipelines. The component leverages the Fortify/components/fcli component to set up fcli, then executes the fcli ci action to run the requested scans and related tasks, providing a unified yet customizable experience across your AST scan workflows on GitLab and other CI systems.
The GitLab integration consists of two components:
-
Fortify fcli component - Provides fcli installation and setup functionality. This component allows for setting up fcli for use in custom CI/CD workflows.
-
Fortify AST Scan component - Provides complete AST scanning workflow by including the fcli component and adding scan execution jobs.
The ast-scan component provides the following runnable jobs:
-
Inherited from the fcli component:
-
<job-name>-prepare: Download and install fcli -
<job-name>: Run the Fortify AST scan
-
-
Provided by the ast-scan component:
-
<job-name>-publish-debug-output: Optionally publish debugging output -
<job-name>-publish-sast: Publish SAST report to GitLab security dashboard
-
In addition, several hidden jobs are defined by the component which may be used to implement advanced use cases but should not be directly customized.
Quick Start Example
Minimal configuration for running OpenText Fortify AST scans.
include:
- component: $CI_SERVER_FQDN/Fortify/components/ast-scan/linux@1
inputs:
job-name: fortify-ast-scan
stage: test
fcli-version: v3
stages: [test]
fortify-ast-scan:
image: maven:3-openjdk-17 # Docker image with build tools
variables:
SSC_URL: ${SSC_URL} # From GitLab CI/CD variables
SSC_TOKEN: ${SSC_TOKEN} # From GitLab CI/CD variables
SC_SAST_TOKEN: ${SC_SAST_TOKEN} # From GitLab CI/CD variables
# SSC_APPVERSION: MyApp:main # Optional: defaults to repo:branchTips & Recommendations
Centralized Configuration Management
For enterprise environments with multiple repositories, consider creating custom GitLab components or pipeline templates to wrap the Fortify integration. This approach provides:
-
Version stability: Pin specific component versions (e.g.,
@1.0.1instead of@1) and fcli versions across all pipelines -
Consistent configuration: Centrally manage common settings like tool versions and scan parameters
-
Controlled upgrades: Test new versions centrally before rolling out to all repositories
Example custom component or template structure:
# In your organization's shared component/template repository
include:
- component: $CI_SERVER_FQDN/Fortify/components/ast-scan/linux@1.0.1 # Pinned version
inputs:
job-name: fortify-ast-scan
stage: security
fcli-version: v3.15.0 # Pinned fcli version
fortify-ast-scan:
variables:
SSC_URL: ${SSC_URL}
SSC_TOKEN: ${SSC_TOKEN}
SC_SAST_TOKEN: ${SC_SAST_TOKEN}
extends: .my-shared-config # Additional organization-wide settingsAir-Gapped Environments
For air-gapped or restricted network environments, host custom tool definitions and tool bundles in an internal SCM repository or artifact registry. Configure the integration to use these internal resources:
-
Set
TOOL_DEFINITIONSto point to your internally hosted tool definitions file -
Set
FCLI_TGZ_URLto download fcli from your internal mirror
This ensures all required tools are accessible without external internet access.
Configuration
Component Inputs
The following component inputs can be specified when including the ast-scan component:
| Input | Description | Default |
|---|---|---|
|
Job name for the Fortify AST scan. This must be a valid file system path name and will be used to name the component-provided jobs. |
|
|
GitLab CI/CD stage in which to run the AST scan jobs. This stage must be defined in your pipeline’s |
|
|
Fcli version to use for running the AST scan. Note that not all fcli versions may be compatible with this component, so avoid overriding unless necessary. |
|
|
GitLab access level required for accessing scan reports. Allowed values: |
|
|
GitLab access level required for accessing debug logs. Allowed values: |
|
|
GitLab |
|
|
Whether to generate and collect debug logs. Note that these may contain sensitive data like access tokens or credentials. |
|
|
Allows for overriding the default Alpine image used by various jobs, for example to use an image from a custom registry. |
|
Configuration is accomplished through environment variables set on the main scan job (see following sections). Unlike GitHub Actions which use action inputs for some configuration, the GitLab components use environment variables exclusively for scan configuration, following GitLab CI/CD conventions.
Setup & Bootstrap
The environment variables in this section allow you to customize bootstrapping behavior
of fcli and supporting tools like ScanCentral Client. These variables can be configured
on the <job-name>-prepare job as needed.
|
Note
|
This GitLab Component requires a recent fcli v3.x.y version to function properly. |
|
Note
|
Environment variables listed in the subsequent sections are for fcli 3.15.0; if your bootstrap settings install another fcli version, please refer to to the fcli ci action documentation for that version. |
Environment Variable |
Description |
FCLI_TGZ_URL |
By default, fcli is downloaded from the official GitHub releases page at |
FCLI_RSA_SHA256_URL |
URL for the fcli RSA SHA256 signature file. Defaults to |
FCLI |
Path to a pre-installed fcli executable. When set on the |
TOOL_DEFINITIONS |
Supporting tools like ScanCentral Client or Debricked CLI are by default downloaded from the URLs defined in the default Fortify tool definitions. For airgapped environments, point this environment variable to an internally hosted custom tool definitions zip file to download these tools from an internal mirror. |
PREINSTALLED |
Set to |
Authentication & Connection
Configure credentials and connection details for OpenText Application Security (Fortify Software Security Center).
Environment Variable |
Description |
SSC_URL |
OpenText Application Security (Fortify Software Security Center) URL, for example |
SSC_TOKEN |
Required when authenticating with an SSC token (recommended). Most actions should work fine with a CIToken. |
SSC_USER |
Required when authenticating with SSC user credentials. |
SC_SAST_TOKEN |
ScanCentral SAST Client Authentication Token for authenticating with ScanCentral SAST Controller. This environment variable is required when running a ScanCentral SAST scan. |
SSC_LOGIN_EXTRA_OPTS |
Extra SSC login options, for example for disabling SSL checks or changing connection time-outs; see |
Application Version Management
Configure OpenText Application Security (Fortify Software Security Center) application version settings, including automatic creation of application versions if they don’t exist.
Environment Variable |
Description |
SSC_APPVERSION |
Fortify SSC application version to use with this action. This should be specified as |
DO_SETUP |
If |
Package Configuration
Configure source code packaging behavior for SAST scans. Control whether to use custom packaging actions, specify pre-built packages, or customize ScanCentral Client usage.
Environment Variable |
Description |
PACKAGE_ACTION |
By default, when running a SAST scan, the fcli package action is used to (optionally) package the source code to be scanned; see next entry for information on how to configure the default package action. If the standard fcli package action doesn’t meet your needs, for example if you want to perform a local translation using Fortify Static Code Analyzer, you can use |
USE_PACKAGE |
These environment variables define packaging behavior. If |
Scan Execution
Configure SAST and Debricked scan execution and waiting behavior for OpenText Application Security (Fortify Software Security Center).
Environment Variable |
Description |
DO_SAST_SCAN |
The fcli |
DO_DEBRICKED_SCAN |
The fcli |
DO_WAIT |
By default, the fcli |
Post-Scan Actions
Configure post-scan tasks including Aviator auditing, application version summaries, policy checks, pull request comments, and vulnerability data exports for OpenText Application Security (Fortify Software Security Center). NOTE: Availability and behavior of post-scan tasks may vary across CI/CD systems and fcli versions.
Environment Variable |
Description |
AVIATOR_URL |
Aviator URL and JWT token to use for Aviator operations (see below). The |
DO_AVIATOR_AUDIT |
If |
DO_APPVERSION_SUMMARY |
If |
DO_CHECK_POLICY |
If |
DO_PR_COMMENT |
(PREVIEW) If |
DO_SAST_EXPORT |
If |
DO_DEBRICKED_EXPORT |
If |
Advanced Customization
Customizing the <job-name> Job
The main <job-name> job can be customized to specify the Docker image providing build tools, additional
environment variables, and other job properties:
<job-name>:
image: golang:latest # Required: Docker image with build tools
extends:
- .<job-name>-vars-ci # Required: inherit component variables
- .my-custom-vars # Optional: inherit additional variables
variables:
FOD_URL: https://ams.fortify.com
FOD_CLIENT_ID: ${FOD_CLIENT_ID} # From GitLab CI/CD variables
FOD_CLIENT_SECRET: ${FOD_CLIENT_SECRET}
# Additional scan configuration...If you override needs or extends, make sure to keep the original contents to ensure the component
functions correctly.
Customizing Report Publication
The component automatically publishes SAST reports to GitLab’s security dashboard through the
<job-name>-publish-sast job. You can customize the access level for these reports through the
reports-access component input.
Debug output publication is controlled by the debug component input. When enabled, the
<job-name>-publish-debug-output job will collect and publish logs, package files, and FPR files
as GitLab artifacts.